At runtime, the package exposes an obfuscated HTTP forwarding function unrelated to secp256k1. It sends caller-provided data to a concealed external endpoint and suppresses failures.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer imports the module and calls connet(value).
Impact
Caller-supplied sensitive values can be covertly exfiltrated.
Mechanism
Obfuscated axios request to a concealed remote base URL.
Attack narrative
The sole implementation is a heavily obfuscated loader with anti-debugging logic. It decrypts axios and an external API base URL, then connet(value) makes a request to that URL plus value while ignoring errors. This bears no relation to the claimed secp256k1 package purpose and can covertly transmit values supplied by consuming code.
Rationale
The concealed outbound request, silent failure handling, and complete mismatch with the package name establish a concrete data-exfiltration capability. There is no install hook, but runtime use of the exported function activates the behavior.
Evidence
package.jsonindex.jsREADME.md